Extracted

• • Target

    0371000451985082024.exe

  • Size

    626KB

  • MD5

    13ef13f688d826fd3056f6c857ab1fc5

  • SHA1

    612b8e9184eac0824b2e3887f3c9c842ea6a5155

  • SHA256

    22e07732afa9d6a1c689bd93a3f5b60205310ef8f4225aa00391d8da73d88108

  • SHA512

    105d97630fb3cd069d1161777b5ad00de526af2822f1d1570dbeef6bddd9fdac90085e100aae0b6328b972747d17794269f7a959f76c1fc5e052f224eaac1313

  • SSDEEP

    12288:2hwU3929BC4rqhpFDEDtzQzc1eyVUDmrqWzLjP5D03qPtp6atkR:9U89BNuhwhq8ZYNCBDsCtp6aw

  Score

  10^/10

  lokibotcollectioncredential_accessdiscoveryexecutionspywarestealertrojan

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2